What is the CVSS score of CVE-2026-34699?

CVE-2026-34699 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Adobe InDesign are affected by CVE-2026-34699?

Adobe InDesign versions 21.3 and earlier contain a heap-based buffer overflow vulnerability enabling arbitrary code execution when users open maliciously crafted design documents, affecting any…

How to fix or mitigate CVE-2026-34699?

Within 24 hours: Inventory all InDesign installations and identify systems running versions 21.3, 20.5.3, or earlier; implement intake controls restricting document opening to verified trusted sources only. Within 7 days: Deploy email gateway rules blocking .indd and .idml file attachments from external senders; execute user awareness campaign on risks of opening unsolicited design files. Within 30 days: Monitor Adobe Security Bulletin for patch release; establish upgrade timeline to patched versions when available; evaluate sandboxed or virtual environments for handling untrusted external design files.

Adobe InDesign CVE-2026-34699

EUVD-2026-35777 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 adobe

GHSA-rp93-mmx2-chm6

RCE Buffer Overflow Heap Overflow Adobe Indesign Desktop

7.8

CVSS 3.1 · Vendor: adobe

Severity by source

Vendor (adobe) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (adobe) · only source for this CVE.

CVSS VectorVendor: adobe

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:56 vuln.today

DescriptionCVE.org

InDesign Desktop versions 21.3, 20.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

AnalysisAI

Arbitrary code execution in Adobe InDesign Desktop versions 21.3, 20.5.3 and earlier is possible when a user opens a maliciously crafted document, triggering a heap-based buffer overflow. The flaw runs code in the context of the logged-in user and was reported by Adobe; no public exploit identified at time of analysis and EPSS data is not provided.

Technical ContextAI

InDesign Desktop is Adobe's professional desktop publishing application used widely in print and digital media production, parsing complex proprietary file formats such as INDD, INDT, IDML and embedded image/font resources. The root cause is CWE-122 (Heap-based Buffer Overflow), where malformed structures in a document cause the parser to write past the bounds of a heap-allocated buffer, corrupting adjacent heap metadata or objects and enabling control of execution flow. The single CPE entry cpe:2.3:a:adobe:indesign_desktop:*:*:*:*:*:*:*:* confirms the affected product family is the InDesign Desktop application across platforms (Windows and macOS builds).

RemediationAI

Apply the vendor-released patch by updating Adobe InDesign Desktop to the fixed version listed in Adobe Security Bulletin APSB26-58 (https://helpx.adobe.com/security/products/indesign/apsb26-58.html) using the Creative Cloud desktop application or enterprise admin console; the bulletin enumerates exact fixed builds for InDesign 2025 (20.x) and 2026 (21.x) tracks. Until patching is complete, restrict opening of untrusted INDD, INDT and IDML files received via email or downloaded from the web, route incoming design assets through a sandboxed review workstation, and consider deploying attack-surface-reduction rules or application-control policies that block InDesign from spawning child processes such as cmd.exe, powershell.exe or wscript.exe - be aware this can break legitimate scripting workflows and plug-ins. Removing local administrator rights on creative endpoints limits post-exploitation impact but does not prevent the user-context code execution itself.